AMENDMENTS TO THE CLAIMS : 

This listing of claims will replace all prior versions and listing of claims in the above- 
referenced application. 
Listing of Claims : 

1 . (Previously Presented) A method for detecting an inconsistent data structure 
comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determining during execution of a program whether said data structure of 
said program violates said at least one consistency constraint, wherein said program is 
configured to perform said dynamically determining as part of consistency checking processing 
in accordance with one or more of: a signal handler that processes a detected fault, wherein, upon 
the occurrence of said detected fault, said signal handler is invoked and wherein said signal 
handler subsequently invokes said consistency checking processing, a consistency check of a 
portion of said data structure at a first execution point in accordance with either a previous usage 
of said portion or a subsequent usage of said portion within said program, or at least one user 
specified execution point of said program. 

2. (Original) The method of Claim 1, wherein said specification comprises at least one 
logical formula. 

3. (Original) The method of Claim 2, wherein said specification includes at least one 

consistency constraint expressed in terms of said data structure. 
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4. (Previously Presented) A method for detecting an inconsistent data structure 
comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constraint, wherein said specification comprises at least one 
logical formula, said specification includes at least one consistency constraint expressed in terms 
of said data structure, and 

wherein, prior to dynamically determining whether said data structure violates said at 
least one consistency constraint, it is determined whether repairing the data structure according 
to the at least one consistency constraint will terminate. 

5. (Original) The method of Claim 3, wherein said specification includes a 
description of said data structure. 

6. (Original) The method of Claim 4, wherein said specification includes a 
description of said data structure. 

7. (Original) The method of Claim 1, further comprising: 
representing said data structure as an abstract model; and 
determining consistency constraint violations of said abstract model. 
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8. (Original) The method of Claim 7, wherein said specification includes a description of 
said data structure. 

9. (Original) The method of Claim 8, wherein said specification includes an 
abstract model definition. 

10. (Original) The method of Claim 9, wherein said specification includes an 
internal constraint in terms of said abstract model definition. 

11. (Original) The method of Claim 10, further comprising: 

determining if said internal constraint is violated in accordance with an evaluation of said 
internal constraint. 

12. (Original) The method of Claim 11, wherein said specification includes 

at least one external constraint mapping elements of said abstract model to elements of said data 
structure. 

13. (Original) The method of Claim 10, wherein said description of said abstract model 
includes at least one model definition rule and at least one declaration for one of: a set and a 
relation, said at least one model definition rule representing an element of said data structure in 
at least one of a set and a relation. 

14. (Original) The method of Claim 13, wherein said specification includes 
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at least one external constraint mapping elements of said abstract model to elements of said data 
structure. 

15. (Original) The method of Claim 1, wherein said dynamically determining is 
performed in response to at least one of: an explicit call and a transfer of control to an error 
handler. 

16. (Previously presented) A method for detecting an inconsistent data structure 
comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 
dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constraint; 

representing said data structure as an abstract model; 

determining consistency constraint violations of said abstract model, wherein said 
specification includes a description of said data structure, said specification includes an 
abstract model definition, said specification includes an internal constraint in terms of said 
abstract model definition, and said description of said abstract model includes at least one model 
definition rule and at least one declaration for one of: a set and a relation, said at least one model 
definition rule representing an element of said data structure in at least one of a set and a relation; 
and wherein, prior to dynamically determining whether said data structure violates said at least 
one consistency constraint, it is determined whether construction of said abstract model will 
terminate. 
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17. (Original) The method of Claim 16, wherein, prior to dynamically determining 
whether said data structure violates said at least one consistency constraint, it is determined 
whether said at least one model definition rule has cyclic dependencies which involve negation 
operators. 

18. (Original) The method of Claim 17, wherein said at least one model definition rule is 
of the form: quantifier, Q, guard, G, and an inclusion constraint, I, and the method further 
comprising: 

translating each guard of each of said at least one model definition rule into disjunction 
normal form including a logical ORing of conjunctions, each of said conjunctions including one 
or more predicates; 

constructing a graph representing said at least one model definition rule, said graph 
including a node for each model definition rule, a normal edge from a first rule to a second rule if 
the inclusion constraint for the first rule uses a set or relation which is also used in a guard of the 
second rule or a quantifier of the second rule, a negated edge from the first rule to the second rule 
if the inclusion constraint for the first rule uses a set or a relation which is negated in connection 
with one of a set or relation of the second rule's guard; and 

determining if there are any cycles in said graph with negated edges. 

19. (Previously Presented) A method for detecting an inconsistent data structure 
comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 

and 
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dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constraint; 

representing said data structure as an abstract model; and 

determining consistency constraint violations of said abstract model, wherein said 
specification includes a description of said data structure; and 

wherein, prior to dynamically determining whether said data structure violates said at 
least one consistency constraint, it is determined whether repairing said internal constraints will 
terminate. 

20. (Original) The method of Claim 1, further comprising: 

determining whether a memory reference in connection with said data structure is valid 
in accordance with currently allocated memory of said program. 

21. (Original) The method of Claim 1, further comprising: 

repairing said data structure if said data structure violates said at least one consistency 
constraint. 

22-24. (Canceled) 

25. (Previously Presented) A method of dynamically repairing an inconsistent data 
structure during program execution comprising: 

receiving at least one inconsistency violation; 

selecting a repair to correct said at least one inconsistency violation; and 
repairing said inconsistent data structure; and 
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wherein said inconsistent data structure is represented in an abstract model, and the method 
comprising: 

repairing said abstract model in accordance with an internal consistency constraint; and 
applying a repair to the inconsistent data structure in accordance with an external 
constraint translating said repair from said abstract model to said inconsistent data structure. 

26-28. (Canceled) 

29. (Previously Presented) A method of dynamically repairing an inconsistent data 
structure during program execution comprising: 

receiving at least one inconsistency violation; 

selecting a repair to correct said at least one inconsistency violation; and 
repairing said inconsistent data structure; 

selecting a repair from a plurality of repairs in accordance with a cost associated with 
each repair; and 

wherein said inconsistency violation includes a plurality of conditions, and the method 

further comprising: 

determining which of said plurality of conditions are true; and 

determining a cost for repairing said inconsistency violation in accordance with those 

conditions that are not true. 

30. (Previously Presented) A method of handling an invalid memory reference 
comprising: 

determining whether a memory reference associated with an operation is invalid; and 
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if said memory reference is invalid, performing an action selected in accordance with a 
type of said operation, wherein said type includes at least one of a read operation or a write 
operation, wherein, when said action allows a program including said operation to continue 
executing, said action is a substitute action performed in place of said operation. 

31. (Previously Presented) A method of handling an invalid memory reference 
comprising: 

determining whether a memory reference associated with an operation is invalid; 

if said memory reference is invalid, performing a substitute action selected in accordance 
with said operation in place of performing said operation; 

if said memory reference is associated with a read operation, supplying a default value as 
a result of performing said read operation; and 

if said memory reference is associated with a write operation, disregarding said write 
operation. 

32. (Original) The method of Claim 3 1 , wherein at least one invalid read 
operation has a different default value than at least one other invalid read operation. 

33. (Original) The method of Claim 30, wherein said invalid memory access is 
determined during execution of said program. 

34. (Original) The method of Claim 31, wherein said determining is performed in 
accordance with memory allocations associated with a program execution. 
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35. (Original) The method of Claim 34, further comprising: 

evaluating said memory reference prior to attempting to access a portion of memory. 

36. (Original) The method of Claim 35, wherein at least one of said read operation and 
said write operation uses one of: a pointer access, and an array element for said memory 
reference. 

37. (Original) The method of Claim 36, wherein a program having an invalid memory 
reference continues execution following execution of said substitute action. 

38. (Original) The method of Claim 32, wherein a program having an invalid memory 
reference continues execution following execution of said substitute action. 

39. (Previously Presented) A computer program product that detects an inconsistent data 
structure, the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determines during execution of a program whether said data structure of said 

program violates said at least one consistency constraint, wherein said program is configured to 

perform said dynamically determining as part of consistency checking processing in accordance 

with one or more of: a signal handler that processes a detected fault, wherein, upon the 

occurrence of said detected fault, said signal handler is invoked and wherein said signal handler 

subsequently invokes said consistency checking processing, a consistency check of a portion of 
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said data structure at a first execution point in accordance with either a previous usage of said 
portion or a subsequent usage of said portion within said program, or at least one user specified 
execution point of said program. 

40. (Original) The computer program product of Claim 39, wherein said specification 
comprises at least one logical formula. 

41. (Original) The computer program product of Claim 40, wherein said specification 
includes at least one consistency constraint expressed in terms of said data structure. 

42. (Previously Presented) A computer program product that detects an inconsistent data 
structure, the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives a specification describing at least one consistency constraint of a data structure; 

dynamically determines during execution of a program whether said data structure 
violates said at least one consistency constraint, wherein said specification comprises at least one 
logical formula, said specification includes at least one consistency constraint expressed in terms 
of said data structure; and 

prior to dynamically determining whether said data structure violates said at least one 
consistency constraint, determines whether repairing the data structure according to the at least 
one consistency constraint will terminate. 

43. (Original) The computer program product of Claim 41, wherein said specification 

includes a description of said data structure. 
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44. (Original) The computer program product of Claim 42, wherein said specification 
includes a description of said data structure. 

45. (Original) The computer program product of Claim 39, further comprising 
executable code that: 

represents said data structure as an abstract model; and 
determines consistency constraint violations of said abstract model. 

46. (Original) The computer program product of Claim 45, wherein said specification 
includes a description of said data structure. 

47. (Original) The computer program product of Claim 46, wherein said specification 
includes an abstract model definition. 

48. (Original) The computer program product of Claim 47, wherein said specification 
includes an internal constraint in terms of said abstract model definition. 

49. (Original) The computer program product of Claim 48, further comprising 
executable code that: 

determines if said internal constraint is violated in accordance with an evaluation of said 
internal constraint. 
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50. (Original) The computer program product of Claim 49, wherein said specification 
includes at least one external constraint mapping elements of said abstract model to elements of 
said data structure. 

5L (Original) The computer program product of Claim 48, wherein said description of 
said abstract model includes at least one model definition rule and at least one declaration for one 
of: a set and a relation, said at least one model definition rule representing an element of said 
data structure in at least one of a set and a relation. 

52. (Original) The computer program product of Claim 51, wherein said specification 
includes at least one external constraint mapping elements of said abstract model to elements of 
said data structure. 

53. (Original) The computer program product of Claim 39, wherein said executable code 
that dynamically determines is responsive to at least one of: an explicit call and a transfer of 
control to an error handler. 

54. (Previously Presented) A computer program product that detects an inconsistent data 
structure, the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives a specification describing at least one consistency constraint of a data structure; 

dynamically determines during execution of a program whether said data structure 

violates said at least one consistency constraint; 

represents said data structure as an abstract model; 
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determines consistency constraint violations of said abstract model, wherein said 
specification includes a description of said data structure, said specification includes an abstract 
model definition, said specification includes an internal constraint in terms of said abstract model 
definition, said description of said abstract model includes at least one model definition rule and 
at least one declaration for one of: a set and a relation, said at least one model definition rule 
representing an element of said data structure in at least one of a set and a relation; and 

prior to dynamically determining whether said data structure violates said at least one 
consistency constraint, determines whether construction of said abstract model will terminate. 

55. (Original) The computer program product of Claim 54, further comprising 
executable code that, prior to dynamically determining whether said data structure violates said 
at least one consistency constraint, determines whether said at least one model definition rule has 
cyclic dependencies which involve negation operators. 

56. (Original) The computer program product of Claim 55, wherein said at least one 
model definition rule is of the form: quantifier, Q, guard, G, and an inclusion constraint, I, and 
the computer program product further comprising executable code that: 

translates each guard of each of said at least one model definition rule into disjunction 
normal form including a logical ORing of conjunctions, each of said conjunctions including one 
or more predicates; 

constructs a graph representing said at least one model definition rule, said graph 

including a node for each model definition rule, a normal edge from a first rule to a second rule if 

the inclusion constraint for the first rule uses a set or relation which is also used in a guard of the 

second rule or a quantifier of the second rule, a negated edge from the first rule to the second rule 
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if the inclusion constraint for the first rule uses a set or a relation which is negated in connection 
with one of a set or relation of the second rule's guard; and 

determines if there are any cycles in said graph with negated edges. 

57. (Previously Presented) A computer program product that detects an inconsistent data 
structure, the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives a specification describing at least one consistency constraint of a data structure; 
dynamically determines during execution of a program whether said data structure 
violates said at least one consistency constraint; 

represents said data structure as an abstract model; and 

determines consistency constraint violations of said abstract model, wherein said 
specification includes a description of said data structure; and 

prior to dynamically determining whether said data structure violates said at least one 
consistency constraint, determines whether repairing said internal constraints will terminate. 

58. (Original) The computer program product of Claim 39, further comprising 
executable code that: 

determines whether a memory reference in connection with said data structure is valid in 
accordance with currently allocated memory of said program. 

59. (Original) The computer program product of Claim 39, further comprising 
executable code that: 
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repairs said data structure if said data structure violates said at least one consistency 
constraint. 

60-62. (Canceled) 

63. (Previously Presented) A computer program product that dynamically repairs an 
inconsistent data structure during program execution, the computer program product comprising 
executable code stored thereon for execution by a processor that: 

receives at least one inconsistency violation; 

selects a repair to correct said at least one inconsistency violation; 

repairs said inconsistent data structure; and 
wherein said inconsistent data structure is represented in an abstract model, and the computer 
program product comprising executable code that: 

repairs said abstract model in accordance with an internal consistency constraint; and 

applies a repair to the inconsistent data structure in accordance with an external constraint 
translating said repair from said abstract model to said inconsistent data structure. 

64-66. (Canceled) 

67. (Previously Presented) A computer program product that dynamically repairs an 
inconsistent data structure during program execution, the computer program product comprising 
executable code stored thereon for execution by a processor that: 

receives at least one inconsistency violation; 

selects a repair to correct said at least one inconsistency violation; 
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repairs said inconsistent data structure; 

selects a repair from a plurality of repairs in accordance with a cost associated with each 
repair; and 

wherein said inconsistency violation includes a plurality of conditions, and the computer 

program product further comprising executable code that: 

determines which of said plurality of conditions are true; and 

determines a cost for repairing said inconsistency violation in accordance with those 

conditions that are not true. 

68. (Previously Presented) A computer program product that handles an invalid memory 
reference comprising executable code stored thereon for execution by a processor that: 

determines whether a memory reference associated with an operation is invalid; and 
if said memory reference is invalid, performs an action selected in accordance with a type 
of said operation , wherein said type includes at least one of a read operation or a write operation, 
wherein, when said action allows a program including said operation to continue executing, said 
action is a substitute action performed in place of said operation. 

69. (Previously Presented) A computer program product that handles an invalid memory 
reference comprising executable code stored thereon for execution by a processor that: 

determines whether a memory reference associated with an operation is invalid; and 

if said memory reference is invalid, performs a substitute action selected in accordance 

with said operation in place of performing said operation; 

if said memory reference is associated with a read operation, supplies a default value as a 

result of performing said read operation; and 
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if said memory reference is associated with a write operation, disregards said write 
operation. 

70. (Original) The computer program product of Claim 69, wherein at least one invalid 

read 

operation has a different default value than at least one other invalid read operation. 

71. (Original) The computer program product of Claim 68, wherein said invalid memory 
access is determined during execution of said program. 

72. (Original) The computer program product of Claim 69, wherein said executable code 
that determines is performed in accordance with memory allocations associated with a program 
execution. 

73. (Original) The computer program product of Claim 72, further comprising 
executable code that: 

evaluates said memory reference prior to attempting to access a portion of memory. 

74. (Original) The computer program product of Claim 73, wherein at least one of said 
read operation and said write operation uses one of: a pointer access, and an array element for 
said memory reference. 

75. (Original) The computer program product of Claim 73, wherein a program having an 

invalid memory reference continues execution following execution of said substitute action. 
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76. (Original) The computer program product of Claim 70, wherein a program having an 
invalid memory reference continues execution following execution of said substitute action. 

77. (Previously Presented) The method of Claim 30, wherein said action includes 
performing at least one of: no action at all, discarding said operation, reading a location other 
than a location specified by the invalid memory reference, writing to a location other than a 
location specified by the invalid memory reference, writing a value other than a value specified 
by the invalid memory reference, or supplying a default value. 

78. (Previously Presented) The method of Claim 30, wherein there are at least two actions 
and a first of said actions supplies a different value than a second of said actions. 

79. (Previously Presented) The computer program product of Claim 68, wherein said 
action includes performing at least one of: no action at all, discarding said operation, reading a 
location other than a location specified by the invalid memory reference, writing to a location 
other than a location specified by the invalid memory reference, writing a value other than a 
value specified by the invalid memory reference, or supplying a default value. 

80. (Previously Presented) The computer program product of Claim 68, wherein there are 
at least two actions and a first of said actions supplies a different value than a second of said 
actions. 
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